Amazon IAM Identity Center simplifies identity source changes from Active Directory
Amazon IAM Identity Center now retains your workforce identities and their assignments when you change your identity source from Active Directory to an external identity provider (IdP), such as Okta or Microsoft Entra ID, or to the Identity Center directory. Specifically, it preserves your users, groups, group memberships, permission set assignments, and application assignments. Previously, this change required you to recreate them in IAM Identity Center.
IAM Identity Center helps you connect your workforce identities to Amazon Web Services once and manage their access centrally across Amazon Web Services applications and accounts. When you change your identity source from Active Directory, your existing identity store remains in place, so your users and groups keep the same IDs. As a result, users retain their access to Amazon Web Services accounts and applications, and policies that reference your user IDs, group IDs, or identity store ID continue to work.
To make this change, configure your new identity source with the standard setup required for users to sign in. After the change, your workforce signs in through your dual-stack Amazon Web Services access portal URL. Changing your identity source in the other direction, to Active Directory, works as before. This feature is available for organization instances of IAM Identity Center in all Amazon Web Services Regions where IAM Identity Center is available, including the China (Beijing) Region, operated by Sinnet, and the China (Ningxia) Region, operated by NWCD. IAM Identity Center is provided at no additional cost.
To get started, navigate to the IAM Identity Center console. For more information, see Change your identity source in the IAM Identity Center User Guide. To learn more about IAM Identity Center, visit the Amazon IAM Identity Center page.